{"id":"MAL-2025-47814","summary":"Malicious code in zenomenallib (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016)\nPackage is prepared to exfiltrate sensitive files. Different packages use different places for the malicious code: it runs during importing the module, is placed in a native binary, or in the setup.py script\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-08-xenlib\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n","modified":"2026-03-19T12:58:23.851835Z","published":"2025-09-09T21:22:39Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2025-09-26T09:14:53Z","sha256":"aaf7926d44586ea02f00b2336539321cd4a1e5b42598161df6f1209baa693bf7","source":"reversing-labs","versions":["2.7.0"],"id":"RLMA-2025-04824","import_time":"2025-09-26T11:05:37.03511685Z"},{"id":"pypi/2025-08-xenlib/zenomenallib","import_time":"2025-12-02T22:30:55.792365184Z","modified_time":"2025-09-09T21:22:39.655225Z","sha256":"3324eaf85f9368bc891dd089cd413ce957702dabc36c0dfc0c1280c384e3bc56","source":"kam193","versions":["2.7.0"]},{"id":"pypi/2025-08-xenlib/zenomenallib","import_time":"2025-12-02T23:07:18.836054707Z","modified_time":"2025-09-09T21:22:39.655225Z","sha256":"4c6be0b94e3c9643885ae8893cd9523bd5ad735965a16a3df64a347bd38f8016","source":"kam193","versions":["2.7.0"]},{"id":"RLUA-2026-00947","import_time":"2026-03-19T12:20:45.848641128Z","modified_time":"2026-03-18T12:21:14Z","sha256":"a684f623b574b542e54511cf3c3530dc551825eed72db6de1b1ea5584cb571e8","source":"reversing-labs"}],"iocs":{"domains":["xenx.lol"],"urls":["http://api.xenx.lol:14880/ssteal","http://api.xenx.lol:1337/check","http://apis.xenx.lol:1337/check"]}},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/zenomenallib"}],"affected":[{"package":{"name":"zenomenallib","ecosystem":"PyPI","purl":"pkg:pypi/zenomenallib"},"versions":["2.7.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/zenomenallib/MAL-2025-47814.json"}}],"schema_version":"1.7.5","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}